So Good Morning my name is Neir and I'm here to speak a little bit about Bug Bounty Programs
evolution. Before I begin I just want to do a short presentation about myself it will be pretty
quick. So I'm working as security architect for this company but it's not related to
this talk this is something I did before working this company. So a little bit research that
I've done is about this, that and least few open source tools. But actually I'm here because
I'm trying to show something that I've done I'm actually an entrepreneur this is a like hair
care but different spelling. So I just want to show you the research that I've done in last
three years about bug bounty programs. It started actually as an academy final project, I
thought about a way to create a bug bounty program which was something that I saw on I-Test
but not from the skewed perspective but from the IT perspective. So ok I thought
about creating this bug bounty program and I decided that I wanted to upload images like at
testing environment in order to allow this safe bug bounty program. But then I realized ok
may be a problem if wanted to maybe use main frames for the testing and then well it may be
a problem. So I just decided to limited it to a specific scope and thought ok may be I'll use
VMware I can take VMware I can just develop a nice gui and then just let the customers kind of
upload the images to my environment and then they'll be able to do the pan testing
pretty easily, and to be pretty honest cause if someone tries to drop the database well it's a
test environment so that's easy its safe. The problem was during this development that I started
to develop kind of virtual IP addresses which is something that amazon already developed so
I couldn't go with it, it was a paton by Amazon. So I just figured out ok if it could be
done join these guys but yet I just thought about it and if I just define a virtual
environment per tester that would be really great cause every tester will have his own
environment if you have person that takes a test probably you won't see it on the other
environment which is pretty perfect. On the other hand if I wanted to create a new
environment for the tester then I probably will need to pay for the traffic for the vm and
there's a lot of payments on the way when I want to create such an environment per tester and by
the way, no one promises that the tester will find findings so I see only outcomes not incomes.
And then I met this guy, this was my partner his name is Jai. And we decided to kind of
establish a new company which was closed a few months ago. It was a pretty nice concept we
decided to develop a company that does safe bug bounty programs which is -- the
difference between bug bounty programs and safe bug bounty programs is totally different
and I will explain it here. So, I know that that's a failure but yet we decided it may be good to
spread ideas here and let you know what is my thoughts here and what can be improved in the
future. So, let's start with the evolution of bug bounty programs or actually bounty hunters. So
the bounty hunter, not in the visual world let's say the physical world, is someone that
probably don't want to be identified. He's bypassing things as a way of life. So all
he wants is killers like this. They have got Terms and Conditions that are fun by the
way, through tour you will probably find a lot of bounty hunters there. And I saw that
they really know what they want to do. They know where to aim. And they also have few things
that are similar to the way of work that we see today in the bug bounty programs. So, I just
thought about it, if someone tries to kill and he succeeds with it he'll get the money,
obviously. Or maybe he won't and he'll need to kill again. Yeah. But yet if he kills someone
probably he'll get not only the money because that's only one time payment, he'll get a good
reputation. By the way, if he doesn't succeed to kill someone probably he don't get anymore
reputation cause maybe someone killed him. So, as bug bounty hunters there are specific
targets that bounty hunters choose. So, some of them choose to kill animals some of them
choose to kill kids, people, women, politicians, etc. And well any killer also chooses
what to hack or what to kill cause let's say I saw something pretty nice in terms and
conditions that one killer said that if someone just wants him to kill a politician that would
be fast. Doesn't matter if you want to pay more money cause that's the way he works that's
the way he believes it should be done. So that's the physical world, so let's keep it on the
side because that is something old, this is something that started a long time ago. But
does someone know what happened in 1995? Raise your hand if you know what happened in 1995. No
one? Yeah. Yeah, so I wish I had prizes here. You want my iPhone? No? [Laughter] It's old. So,
yeah Netscape established the first bug bounty program. And, well -- the first bug bounty
program actually was not in terms of security it just -- these guys just wanted to do
good QA for their environment and they thought ok maybe a lot of people will be smarter than 5
people that testing the software. So they just decided to put the trunk of their
development and just let the QA to test it. It was pretty nice, but I don't think it worked.
Well, I'll explain it. That's pretty easy. Just putting the code there somewhere and the
testers went to this code and was able to test it and as long as they submit findings that was
nice. But then comes the part of the rewards. Well, someone knows what were the rewards then in
1995? Raise your hand if you heard about it. No? Ok great. So, there's a Netscape polo
t-shirt that was nice and a Netscape mug that's all, no money, just prizes. And you know
what? A lot of people did it because they wanted a mug with a Netscape logo. I know they
couldn't afford themselves to buy the mug with the Netscape logo, so they just got it. So,
do you think it was a successful story or not? Raise your hand if you think it was a success
story. All the rest, get out. Ok. So, it was a success story and I'll explain you why. In
2004, which was following the requisition of -- which was following the requisition of
Netscape by AOL, a newer foundation started the Mozilla foundation which is something
that uses the same engine that Netscape used and created a new company, Mozilla. So Mozilla is
kind of Netscape but an open source and well they started in 2004 their bug bounty program
and again it succeeded and you'll see the results of today. This is something I just found a
few months ago when it was a result of the Heartbleed attack. They just said, hey guys I just
signed my software kind you find a few vulnerabilities there and I am willing to pay a lot for
that. By the way they are not giving t-shirts anymore for that. So I just thought ok we
know about bug bounty programs and understand that this is pretty good idea and yet I just
want to share with you the perspectives that business thinks about and then what a bug
bounty hunter looks in these programs. So let's start with the business. I just decided to
just leave the perspectives to three. The first of them is the technology perspective let's say
from the technology perspective probably I will need to handle a lot of traffic cause hackers,
they don't use one thread. They don't need to use one thread. So probably they'll use ten threads
or more it depends on the amount of tools they have and how strong their computer by the
way. And then obviously when the customer or the business will receive this traffic it may be
effect on the performance and obviously it can do a lot of other things. So, maybe these
companies need to upgrade their IDS or IPS. By the way this is the one that just barks, right.
This is something else, this can bite, this is the IPS. So this means that I will need to
upgrade my machines in order to stop any attacks from various sources and this will probably
be done on the production environment. On the other hand, maybe I have a WAF so again I
need to pay a lot of money to get a stronger WAF. So that's the technology and it can be
solved by money, not easily but it depends on the size of the company. And then I was just
thinking about the operations. Ok, so we have the operations, we have the bug bounty program
and then the question is how do I manage incidents? Well if someone tries to do -- how do I
manage that? If someone tries to drop my database because he just found a pretty nice Sequel
injection. Well could be a problem because I need an incident response team. And
sometimes in small, medium businesses they don't have an incident response team. So if we
go to the enterprises the big ones probably it's not a problem. But if we go to the
small ones, well they just need to think about maybe engaging a third party company to do this
for them or maybe someone can supply that for them as part of the service of being a bug
bounty program. So this is the first problem, but the second one is gonna be different
because I know that I'll have bugs because someone will finally find something there.
Obviously hackers are pretty good. Mainly if there are a lot of hackers that try to find bugs
there. So, I just thought about it, maybe I should manage it as part of my change control
system. Yeah. And that means that all the developers in the company will be able to see the
bugs. That's not good cause they can sell them pretty easily. So maybe someone that can supply
this bug bounty programs can also supply me a bug bounty management system. Which is
pretty good if it is secure enough. And obviously this is something that should be managed
somewhere in the cloud unless it is proprietary development. So that's just a problem. So, I
just thought about another thing. And this is something that one of the customers that I
worked with, asked me. You know what, no problem I'll get you to do bug bounty program, but what
happens if someone just harms my business? What then? Who should I sue? Well, there are bounty
hunters. How will you sue them? You can't. So probably you will sue the company that engages
these bounty hunters. That's a problem, no one wants to get the liability on that. And by the
way I am not familiar with a see saw that will want to go home because someone just harms his
business and there's no one that he can sue in case of something or in case of breech. So, let me
just split the bug bounty programs into two. There are self owned bug bounty programs
and there are external bug bounty programs. If I talk about the self owned, well there is a
lot of companies that just created their own bug bounty programs for themselves. And you
can see a pretty nice list here. And by the way, if you want there's pretty much a more
extended list on Bug Crowd website. So, this is just an example. And the other external
are actually companies that actually provide the service of creating a bug bounty program.
And I am not sure if I posted all of the companies here but I saw a few logos here, raise your
hand if you are from an external company. Yeah, so there is a lot of people here. Pretty nice. So
let me just explain a little about the external companies because the self owned are the
ones the enterprises can't afford themselves. The self owned are for the rest. One of
the things that I saw or one of these companies, the external ones, that these companies can
actually build an A team, they can build an elite team of Pen Testers. And that's pretty good
because the elite team probably will be better than five other Pen Testers because probably
will fell engaged to the company. I know that you trust this Pen testing company, but
yet there is only 3 to 5 people of my team that does this Pen Testing. On the other hand, when
the external company builds an A team, that means that this company can trust these hackers.
And then they can feel more comfortable when actually engaging them to do Pen Testing
because as I said no one wants to be sued. The next thing that these external companies do or
part of them, the actually verify the identity of the hackers. Because, well I need to
know who's the hacker behind all the testing there. Because if something happens I want to know
how to reach him. So there are a few ways to do identity verification. First of them is
pretty easy, just register with your email but it can be ten minutes mail, but yet someone
can register. On the other hand, I saw one company, I think it was C-nack that actually
identifies with a real ID, identifies these users and that means if someone do something
wrong, he knows that they have his ID. And that's pretty good. The next thing that external
companies do is a search -- is actually the kind of meeting place where -- meeting place is
not a new concept. But yet if you have a good meeting place with a good blog and a good
community probably you'll be able to get better testers. So if you get better testers I
suppose that this company can be -- can provide better services. So this is one thing that this
company do but if you have already a meeting place, probably this company -- by the
way this is or -- the way to do it. This company should be a middle man. That means that if
someone pays for a bug they do kind of revenue sharing so if someone pays I don't know 500
dollars for a bug, let's say the company pays 500 dollars, then probably this external company
will take a specific percent of it as a revenue and will leave the rest of it for the hacker.
The majority by the way should go to the hacker. Another thing that I saw in these external
companies is also a nice idea is the traffic shaping. Traffic shaping is like let's say using
a private VPN, when using private VPN to connect to websites and then to test them,
well, if you've already identified the users then I can actually verify their identity
by using a VPN. On the other hand, a VPN is not the only solution that can be done here.
I for instance did something as URL authentication. I won't provide the solution here but
just think about it and probably you will get to the solution here. So there are a few
benefits and concerns from a business side when you decide to go with the bug bounty programs.
I just want to begin with the benefits. The benefits that -- first of all they have very
payment models they don't need to pay a fixed price all the times as they do with a company.
Unless they want to do a competition which is a pretty nice idea. So they have various
was to give something additional to the testers. So, money is one of them. But hey, most of the
testers want to be on Google. So they have a wall of fame which is pretty nice idea probably you
will see a lot of them. And there are obviously a few prizes. But the thing is that a
hall of fame, let's say Google, you go to Google and you know that the hall of fame is only
for Google. But for the external companies the hall of fame is not only for Google. The hall of
fame is something much wider, it goes to all of the websites that the tester tests. So it can be
good for the testers, they try to go wider but it's not that good for the tester that just
has the mention to let's say test only e-commerce websites. So I just thought about it and
maybe a few promotions can help here. Let's say that this external companies can so ok I
have the hall of fame for all the websites but maybe I should just create a hall of fame per
customer. And then the one that tests only e-commerce websites will be able to get recognition
on it. Another thing that can be done as part of this program is that, well if someone just gets
into the hall of fame of a specific customer probably this customer will want that these
guys that are in the hall of fame will test them again because in the beginning
probably you will find technical things but as long as you test more -- a specific platform you
will understand the business. And when you understand the business it's much more easier
to find bugs. So if you have already experience with one of the customers probably you want
to pay them more to get back. So, this is not something that the external companies should do
probably I believe that customers will want to get these promotions but yet it is a
pretty nice idea. The next thing is a pretty good benefit because as I said a thousand hackers are
much better than 5 and the customers get a real world hacking scenario in this case.
Accept the fact that they have a real world hacking scenario, a company that writes that they
have a bad bug program probably can be pictured as a leader. And why am I saying that, because if
you're not mature enough you won't put a bug bounty program or if it's not early enough
during the development stages. So, if I am just putting in a bad bug program that means that
I know that I need security and I want the best security. Not only from one company but really
from the majority of the hackers. On the other hand, there are a few concerns. Let's
say that the first concern is well what should I test? Should I test the production, should I
test the testings, staging environment, who thinks that the better way to test is the
testing environment? No one? One, ok. Who thinks the production is better? And the
rest? No thinking, or what? [Laughter] Ok, so the testing environment has a benefit. For
instance if someone drops the database it will be only on the testing environment. On the
other hand, no one can promise that the testing environment or the staging environment is
similar to the production and that means that not all high risk vulnerabilities can be
found. Only the specific ones that just developed now. The best example here, just using
SSL I can use not trusted certificate on the testing and then just putting something
trusted on the production environment and then I will need to pay for the hacker although
it's not a vulnerability at all. The next concern is actually data leakage. Let's say we go to
the production and then we have credit cards on the website. Wait we have credit cards? We
have bounty hunters and then we just need to calculate. I have 100,000 credit cards on one hand
and I have $500 price. What would you choose? I think that I would go with the credit cards.
That's better. Another thing that is pretty much a big concern is denial of service.
Well that's pretty obvious because if you have a lot of testers and it goes to the
production environment it is feasible problem. Next one is the way we detect Blackhats.
Because let's say that we have a bug bounty program and we have our perimeter and that's pretty
nice. But then we're exposed to all the good hackers and the bad ones and the thing that we don't
want to happen is this. Well this is Facebook, by the way it's a screen shot from 157 --
raise your hand if you know this website. Ok. So I'll just explain shortly, this is a
website that you can find a lot of exploits there and for part of them you need to pay. So you
don't want to get posted there because the hacker can post the vulnerability there and get a
little bit more money then he planned to get as part of a bug bounty program. Ok, so that's
another concern what happens when there are too many bounty hunters and then not all of them
really understand security. So let's say that something that I got from one of the companies,
that they have a lot of hackers from let's say India, no mentions to harm anyone, but
these hackers sometimes just try to post bugs that are not security bugs. For instance the
CSS here is not working. This is not a security bug. And someone really thinks he will get money
for that? Not really. So the problem here is not the posting of the bugs the problem here is
who verifies that. I can get thousands of bugs of CSS and cracked CSS and then I need to
spend my time as an external company to verify these bugs and if I am not spending this time
probably the customer will have to spend this time to verify CSS bugs, well it can be nice
because we have another QA team but that's not the purpose of this bug bounty program. So
there is something nice that I saw on Bug Crowd's website they actually see what customer --
see or are given identification from the customers that they say, hey guys we have
performance issues just notify the hackers that they need to stop. Yeah so they are sending
mails and notifying the hackers to stop. Most of the hackers will stop so that's kind of a
good solution. Maybe it can be better but this is pretty good solution because if let's say we
don't have an external company it will be hard to identify the users and then send them the
mail because we don't know who tests us. The next one is kind of minimizing the exposure time
let's say that we found something as a hacker on the website and now obviously we are
posting it but then maybe the hacker posts it in other websites so how can I be sure
that actually someone will stop this attack. So I can try to prevent somehow zero days by
just not publishing it somewhere. But yet the company needs to identify that there's a
specific time that they have to fix the issue and if they don't fix it, probably the hacker will
want to publish it. So, these are the perspective from the business side but let's look at
the bug bounty hunters and these guys are obviously the most experienced people in the world
because they tired from working only on their day job they just want to find the next thing. So
they are just looking for bugs in these companies that allow bug bounty programs. But a small
problem that we have here is that it is a little bit hard to, to classify these hackers
because all of them are equal and we don't know which hacker is better and then well, I'm
just competing with other hackers and why is that because they just write that they have
80 years of experience although they have 8 months of experience. So this is not
exactly fair to work with a variety of Pen Testers, but that's a fact that everybody
should work together. So, I just thought about the motivations. Well actually I not only thought
about it I just interviewed a few hackers and I tried to understand what motivates them
to do bug bounty programs. So the first thing is pretty obvious. Yeah. That's what we
all want. But with dollars. Yeah. The next thing is prestige. Hackers want to be the
ones who identified as the best hackers of a certain bug bounty program. Let's say hackers want
to be on Google, Facebook, Paypal and hackers want to be the best of -- excel at a bug
bounty program because that means that they have experience in various websites. Not only
specific websites. And this is good because I think that if someone looks for a name on
Google they probably want to have more than ten pages in Google and this can lead to
this. The next question is, which one of you likes gaming? No one? Ok, that's all? Only
half? Ok. So, hackers, most of them like gaming. And since they like gaming, if you combine
gamification into these programs it will be much easier because let's say you have ranks you
have kind of Kings and new born hackers and then you can give ranks to them that would be
pretty nice because they will try to get to the King hacker. And they won't stop until they
get there. And until they get there probably you invent another ranks. So that's good it
won't end anyway. On the other hand there are a few frustrations on these programs.
The first of them is something that I did a little bit more than a year ago, or less, less
than a year ago. I just found something on a company's website, well it wasn't the
website it was on their messaging system. And I decided to post about it not because I
just wanted the money because this company -- not giving money. I just wanted to post
because I'm using this service. And then I posted it. And I asked them, guys what's going
on? I want to publish it, yeah, I just want to be on Google, but guys tell me what is happening.
And they are not transparent enough they just need the hackers to ask them every time
just pulling data for them. What's going on, are you fixing it? Because no one wants to be
bad. The hackers want to be good, but yet they don't have the patience to wait for that
whole time. >> Keep going. >> Yeah? [Applause] >> Wait another thing is the fact that no one
really knows when bug bounty program stops. They can just post something on a HTML page,
they can say hey guys just stop testing me. I know that you don't see the status so I just
decided to bring it on to you. So you can see that the bug bounty program object changed to
cancelation that's something from Paypal's website. Dam. >> Hey, it's really hard to get
accepted at Def Con. Some love for our first time speaker. [Applause] >> To DefCon!
[Applause] >> Nice Job. >> You have more? >> Yes we do. Do you want another? >> Go ahead.
[Laughter] [Applause] >> I'm sorry the first one is free. [Laughter] >> What about you
guys? No, what about you? Can you drink? >> I'm sorry don't we appear to be drinking? >> Maybe
you are. >> It's five o'clock somewhere. [Laughter] >> To Def Con again! [Applause] >> Carry
on. >> Give me another bottle. [Laughter] >> Ok >> You're cut off! [Laughter] >> Ok >> Speak
responsibly. >> I can't. So, this is one of the problems that we have here. Because no one
really knows when bug bounty program stops and then, I can post a bug as a hacker but then
no one can assure me that I will get the money from it, this is one thing, and worst case
someone can sue me because I am testing the website although it's prohibited. So I have a
case study, I understand that these guys -- Orin maybe in Def Con so if Orin is here, this is
Orin. This is the case study that I got from his website. [Clapping] >> Yeah, you need to
pay me cause I am publishing you. So this is something that I got from his website. Orin is a
bounty hunter and he found something on Google he just exposed the way that he can get
emails on Google you know addresses. I just don't want to get into the details of it
because you can probably find it on his website. But then he posted it to Google and the
first response was denied because it's not a risk that's what Google said. But then he
posted it again while explaining them that this is a real risk and they just decided to reward
him with $500. As a result of it I just started to look at the title of what you've done and I
saw -- well I stopped at page three on Google with virus websites just posting how bad it
is, because he really found something that can cause a lot of losses for Google. I think
someone just calculated it to more than $1,200 -- $12,000 sorry. And it's not really much
money but then the PR would be bad for Google if someone finds that. So that's just a case
study of someone that I believe -- I didn't get this feeling from him but, I believe it can
be a little bit frustrating. Another thing that can be a little bit frustrating for
testers is the fact that someone just records what they do. Let's say that I am a hacker I have my
specific knowledge that's my added value. I don't want that someone else will log everything
I do. And if he logs maybe his purpose is to replace me at certain -- certain time of the
testing. That's the way by the way of developing security tools. Because they learn how
hackers work. But no one wants to be the one that just everyone knows what he knows. There's the
way that hackers get money. So those are generally the things that are related to the business
end for the testers. But I am here actually to explain to you a little bit more about what I
can see in the future about bug bounty programs. And well, I think that we need to change
something. And I am not saying that it's something that should be done by all the external
companies, I am just saying that this is a conceptual thing that should be done. So one of the
things that I believe that should be done for testing purposes is actually the fact
that these external companies should be like front end server. And that means that if someone
tests during testing, a front end server should control a lot of things that I will explain
here and then the benefits are that the front end server knows exactly who are all the testers.
And on the other hand if the front end server wants to log something about the hackers
probably he will be able to do it and then develop the next product. I know that this is bad
for the hackers but this is good for business. So I just thought about how to minimize the
security risks by creating bug bounty program and I thought, ok if we'll allow Pen Testing and
then prevent the malicious exploitation it can be nice. But hey I can't put a WAF there
cause a WAF will stall the Pen Testing. Obviously. So this is a pretty good challenge. If
someone tries to do that because there is a lot of fine tuning that should be done here. But
yet, that is the idea. So if we just try to minimize the risks, I think that we can start with
data leakage, that's a pretty good example because we said that this is one of the concerns
that business have. And we want to take one step further here so if we have a front end server we
can kind of do deep pack inspection and actually see what is going on there. So if we are
able to see what's going on there and we can validate using a regular expression how
actually credit cards look like, we'll be able to stop data leakage. And it can be done on
credit cards, social security numbers or anything that can work with regular expressions.
What I've did then when I had this middle server I actually created a page. This page
actually was kind of replace response for the hackers that says hey man you found
something! Congratulations! The token of what you've found is this one. Please post this token
with your name and you'll get rewarded for that. Obviously someone will need to validate
it. But yet the hacker won't be exposed to credit cards. And this is good for the business.
It really minimizes the risk. Another thing is the fact that, as we all know, organizations
can ddos. So if we have front end server -- I'm not saying that front end server should be
a ddos prevention product but if this product can somehow use another ddos protection server
it could be pretty good because the websites won't be effected by ddos. The only ones that can
be effected by ddos is the external company. Another thing that I just got an input from
one of the customers that I had, he asked me, you know what? I want to upgrade a version of the
website and I am really afraid because this is the production and I don't want the hackers to
be able to test me while I am just upgrading the version because bounty hunters are from
all over the world so an IT job is not exactly an IT job right? It's 5am somewhere. So there
should be kind of an on off switch for the testers if someone wants to do upgrades or
any other maintenance things on the website. And the concept is pretty, pretty simple. The
testers doing their job or just stopping their job using the front end server and then when
finishing the testers can continue to work. Next one is actually we said that someone
can exploit something and then report it somewhere else. So I was just thinking if we have the
front end server and we are able to log the attempts that hackers have, probably we will be able
to identify part of their attacks, the malicious attacks or at least the ones that are
not false positives. I know that -- it's a great challenge to find not false positives. But
yet, if we are able to get it, let's assume that in order to minimize this risk we'll be able
to create a WAF rule and then the customer can just -- with the code fixing. But for now we
can just supply him a WAF rule and then, let's say he goes with an open source WAF, multi
security and then we're just generating a multi security rule and that's all. Fix the problem.
And by the way, if this front end server has a WAF by itself we can do something even better.
We can actually allow QA. Because we can apply the patch on the front end server and then
let the testers just test everything and add the QA team and then probably would have a
pretty good QA testing scenario and we would see that we don't have bugs and take this rule
from the testing environment to the production which is also pretty awesome to have already
imbedded testing environment. So how do we really -- can identify Blackhat hackers. As I said we
need to somehow allow Pen Testing and prevent malicious exploitation. So I just decided
to give you a few examples of what is legitimate and what is malicious. Let's say this kind
of Sequel injection is pretty legitimate. Next one is also legitimate. All of the selects
are -- most of the selects are legitimate. On the other hand, if we go with the malicious
Sequel injection that's pretty nice. Yeah, especially on production. [Laughter] Yeah.
It's even better if you can drop the backups. So this is one second thing that maybe may
include invasions. So that's kind of other way to do it. And the last one shows that just
selecting data is not only something that is legitimate but selecting data can actually
select a file from the file system and then it can be actually malicious. So there is
a lot of fine tuning that should be done in such a front end server and it's not a WAF. This
is something that is much wider than a WAF. Because WAF will stop all of this payloads. Or at
least should stop all of these payloads. So the problem is that we have Blackhat hackers and
somehow we need to ban them from the system because we don't want them in the system. So the way
to ban them is by just using authentication. If we know who they are and they already
registered to our system then probably we will need to identify them. It can be done
through ID, it can be done through as I said VPN, URL identification or other creative
methods. All of you security guys will probably find other ways except the ones I just
mentioned. So if I am thinking a little bit forward. I think that not only hackers should be in
bug bounty programs. I think that if we just engage in other people to the bug bounty
programs it can be even better because for instance let's say that we have attorneys. The
attorney probably won't find Sequel injection. Obviously the attorney doesn't know what is
Sequel injection unless someone learned to be an attorney and he is a hacker which I don't think
there are people here like that. But yet, the attorney can find incorrect terms and conditions
on the website. And this is pretty nice. This is a pretty short test and if he finds
something he can just report the bug which is a business bug it's not exactly a technical bug and
that's nice. Other things are also a business analyst which can test the flow, test the
flows that we have in our application. And sometimes the flow can be incorrect and
obviously I am talking about security analyst and I'm not speaking about kind of product
analysts that don't understand security. So I'm saying that when we have bug bounty programs
probably we will need other guys except the technical ones to do the job and we will probably
need to involve them in other ways. I don't have the properties of all of these
characteristics but we will probably need to understand what it means but -- yet it is a good
idea. So just to sum it up, I just think that the bug bounty programs is a great idea. it can
be done through internal or external program. The external ones as far as I understand up
to now are pretty good. And I think that we will find a lot of these programs in the future.
But yet, if I'm thinking about the business perspective and the one that really wants to defend
his organization and don't want to go home because someone has breached, I suppose we have a
long journey in front of us to fix all these risks or at least part of them and then we will be
much safer. And if you have any questions there is time. [Applause] >> Thank you.